FR2740235A1 - Operation controller for on-board electronics in motor vehicle - Google Patents

Abstract

The controller (6) provides dynamic control of access by a microcontroller (2) to memory (3). The memory is divided into zones with different programs having access only to their own zone. The controller generates an error signal that is sent to an error handler (8) in the event of an attempt at access to an unauthorised zone. The controller compares access information to predetermined reference information associated with each storage zone. The reference information is stored in the memory of the controller. The comparison determines whether the access address is in the allowed address range.

Description

 The present invention relates to a device for controlling the operation of an electronic system on board a motor vehicle.

 More particularly, the present invention relates to a device of the type comprising an information processing unit based on a microcontroller associated with storage means comprising areas for storing codes corresponding to different programs executable by the microcontroller and, for each executable program, at least one authorized data storage area accessible for writing and / or reading by the microcontroller.

 This type of electronic system has been developed in the state of the art to allow the use of a limited number of information processing units fulfilling different control functions of different functional organs of the vehicle, such as for example the means of suspension thereof, means of controlling the operation of the engine thereof, etc.

 However, the significant development of these embedded systems considerably increases the size of the corresponding software, which thus becomes a critical component in these systems. In addition, in many applications, having different levels of criticality, several functions are brought to coexist on the same physical support, that is to say on the same information processing unit.

 However, units of this type can be disturbed by the environment of the vehicle, that is to say for example by electric fields or electromagnetic fields, temperature, air humidity, or even tremors. linked to road inequalities, etc ...

 Different safety measures must then be considered, all the more so since certain functions, such as that linked to braking, are more critical than others, such as that linked to the interior lighting of the vehicle.

 These securities must implement techniques for securing the operation of the system.

 However, all the known techniques for tolerating software faults by diversification and memory segmentation by MMU (Memory Management Unit) controller cannot be used. Indeed, these techniques, effective when the application is distributed on different physical supports, which is the case for example of on-board avionics systems, are not adapted to the problem of motor vehicles because the cost constraint is much stronger.

 Due to this high cost constraint, the systems on board motor vehicles must be of the monoprocessor type. A possible solution is then the VCP (vital coded processor) used in the railway sector. However, this approach based on a purely informational redundancy concept is not suitable for automotive applications. Indeed, the introduction of an arithmetic code for each memory datum is far too restrictive today, in terms of memory space and therefore in terms of cost.

 This signature analysis technique used by the VCP detects sequencing errors and storage errors. The use of this technique then imposes a deterministic program operating by cycle during which the global signature, calculated online, is compared to a reference signature. This signature analysis technique is effective when the program has few loops. Indeed, in the case where there are loops, jumps, or even interruptions etc ..., it is necessary to add adjustment signatures, essential to obtain an invariance on the global signature.

 However, many automotive applications, such as multiplexing systems for example, use numerous manipulations of bit type data, which results in considerable use of "test and branching" instructions. The use of the signature analysis technique under these conditions then requires incorporating a very large number of adjustment signatures which consume a large memory space.

 In addition, the use of these techniques requires the use of specific tools and in particular software for the calculation of reference signatures.

 All the constraints specific to the automotive sector therefore make this type of mechanism very difficult to set up and manage for systems such as checking the operation of an engine, checking the operation of an automatic gearbox or even checking of the operation of a bodywork multiplexing computer, etc.

 The coexistence in one and the same function information processing unit with different levels of criticality makes it all the more difficult to control the dependability of these on-board systems.

 Therefore, it is necessary to develop a specific control device for the online test which makes it possible to solve the various problems mentioned above.

 To this end, the subject of the invention is a device for controlling the operation of an electronic system on board a motor vehicle, of the type comprising an information processing unit based on a microcontroller associated with means storage unit comprising code storage areas corresponding to different programs executable by the microcontroller and for each executable program, at least one data storage area accessible for writing and / or reading by the microcontroller, characterized in that that it includes means for dynamically controlling access by the microcontroller to the storage areas to generate an error signal in the direction of error processing means, in the event of an access attempt or access from the microcontroller to unauthorized areas.

 The control means can also be arranged to validate or not the access to a storage area.

 Advantageously, the control means comprise means for comparing access information with predetermined reference information associated with the storage areas.

The invention will be better understood with the aid of the description which follows, given solely by way of example and made with reference to the appended drawings in which
- Fig. 1 represents a block diagram illustrating the general structure of an information processing unit
- Fig. 2 illustrates in general a block diagram showing the installation of a control device according to the invention;
- Fig. 3 illustrates the different accesses in such a device;
- Fig. 4 shows a block diagram illustrating the operation of such a device;
- Fig. 5 represents a table illustrating an exemplary embodiment of a descriptor used in a control device according to the invention; and
- Fig. 6 shows a block diagram illustrating the various elements forming part of a control device according to the invention.

 As can be seen in Figs. 1, 2 and 3, a control device according to the invention makes it possible to control the operation of an electronic system on board a motor vehicle, which comprises an information processing unit designated by the general reference 1 based on micro-controller designated by the general reference 2 associated with storage means designated by the general reference 3. These storage means comprise areas for storing codes corresponding to different programs executable by the microcontroller and for each executable program, at least one data storage area, accessible for writing and / or reading by the microcontroller.

 The code storage areas corresponding to the different programs executable by the microcontroller are designated by the general reference 4 in FIG. 3, while the data storage areas accessible for writing and / or reading by this microcontroller are designated by the general reference 5 in this figure.

 Thus a program area A has access to two data storage areas A1 and A2, while a program area B has access to two data storage areas B1 and B2.

 According to the invention, the control device comprises means for dynamic control of the accesses by the microcontroller to the code and data storage areas, to generate an error signal in the direction of error processing means, in the event of an attempt to access or access the microcontroller to non-authorized areas.

 In the example described here, the control means are further arranged to validate or not the access to the data areas.

 In FIG. 2, these control means are called CAM (Memory Access Controller) and designated by the general reference 6 and include for example a descriptor area designated by the general reference 7 in FIG. 3, which will be described in more detail below, while the error processing means are designated by the general reference 8 in FIG. 2.

 This device then makes it possible, by comparison of access information to reference information (descriptor), to provide memory protection between the different code areas corresponding to software which have different levels of criticality.

 Indeed, the main risks inherent in the cohabitation of several software on the same support relate to the illicit alteration of information used by critical software or the illicit activation of part of its code from non-critical software . The prevention principle implemented by the present device is based on the use of access keys to memory areas. Thus, for each defined program code area, two specific memory areas are accessible for reading and / or writing. This thus makes it possible to confine access zones according to the criticality of a software. The verification of the access rights is then carried out dynamically by the device according to the invention which generates an alarm as soon as the software executed is not or is no longer in the predefined area or an attempt to access a prohibited memory area is detected.

 This device is above all a monitoring device and the use of this device is not permanent but is done on demand so as to control the execution of certain code areas.

 This device then makes it possible to effectively complete the mechanisms already known in the state of the art, such as self-tests; etc ...

 In order to optimize the hardware resources of the system, only one key, ie a unique descriptor, can be used at a time. All of the descriptors necessary for the use and protection of the memory areas are implemented in software in the device. Each data structure is protected by the addition of a compaction code which represents its own signature. The data structure is transferred to the processing unit when the device is used. The protection zones can thus be allocated dynamically according to the needs of the memory resources.

 Based on the principle shown in FIG.

3, FIG. 4 shows a first general functional structure of the control device according to the invention.

 Three main functional blocks can be discerned. The first block is a management block designated by the general reference 9 which is activated when an access is received.

 When it comes to access to the control device, this management block 9 transfers the data received to a signature analysis and calculation block designated by the general reference 10.

 The latter formats the descriptor received and calculates the expected signature online. If the signature is not correct, then an error is generated.

When the access concerns a program zone, each instruction address is positioned in adr-Prg. In the same way, each request to access a variable zone is positioned in adr-var.

 The management block 9 generates the ACTIVE signal which verifies the access request directly. If the request for access to a data area is correct, a VALID block 11 authorizes access, otherwise access is blocked and / or an error is generated in the direction of the error processing means. If the access request for the execution of a program zone is incorrect, then an error is generated in the direction of the error processing means.

 It can therefore be seen that the three entities concerned by the control device are the microcontroller 2, the storage means 3 and the error processing means 8.

 The characteristic variable of the microcontroller is the ACCESS information. This is issued by the microcontroller when it wishes to access one of its peripherals.

 The characteristic variable of the storage means is the signal corresponding to the validation of the memory access.

 Finally, the variable which characterizes the error processing means is the ERROR variable generated by the device to indicate unauthorized access to the storage means (interruption and raising of a flag).

 The microcontroller is coupled to the memory access control device via the variable ACCES. This information includes several fields which will be defined in more detail later.

Physically, these fields are transmitted by the data, address and control buses of the microcontroller.

 The behavior of the storage means is purely passive and they receive or transmit data at the request of the microcontroller.

 This is also the case of the error processing means, the role of which is to react to the error signal. In practice, the error handling means must be seen as a mechanism for managing the interrupts of the microcontroller. On the occurrence of an error, an interruption is generated, which causes the operation of this microcontroller to be diverted to a specific program in a conventional manner.

 It can therefore be seen that the role of the control device is to filter the accesses of the microcontroller to the storage means. This device has all the power to censor memory access when it is prohibited. The validation of the access is carried out by comparison of the access rights to a reference previously called descriptor.

 The method of loading this reference does not matter for understanding the operation of the device, but in this case it may be noted that it is carried out by successive writing in a memory space of the device, reserved for the storage of descriptor information.

 In fact, the control means comprise means for comparing access information with predetermined reference information associated with the storage areas.

 This reference information is preferably stored in storage means of the control means and the access information and the reference information can be addresses for accessing the storage areas.

 Three types of comparison can then be implemented and evaluated.

 The first type of test concerns the validation of the output, i.e. access, if the input value is within an authorized interval, i.e. between a minimum reference (low address ) and a maximum reference (high address).

 The format of the descriptor for an address (program or variable) is then two words for example of 16 bits comprising a high address and a low address.

 The second type of test concerns the validation of the output if the input value is between a minimum reference (low address) and this minimum reference plus a variable offset (low address plus offset).

 The format of the descriptor for an address is then of a word of 16 bits for example (low address) and a word of 8 bits (offset).

 The third type of test concerns the validation of the output if the input value is between a minimum reference and this minimum reference plus a fixed offset.

 The format of the descriptor for an address is then a word of 16 bits (low address) while the format of the offset is fixed once and for all.

 Two criteria guide the choice of one of these three types of test, these criteria being the size and speed.

 The smaller the footprint, the greater the probability of integrating all the functions in the same component. The faster an algorithm, the better the chances of obtaining a convincing result in an application where the time factor is crucial. It should be noted that one method often favors one to the detriment of the other.

 In addition to the information for defining the address areas, the descriptor also includes information for defining the access rights to the variable areas, which may be the four least significant bits for the access rights of the variable zone 1 and the four most significant bits for the access rights of variable zone 2 and a checksum information item "Checksum" for checking the validity of the descriptor after its loading.

 In view of this, the last two types of test described above have the drawback of requiring an addition. However, this operation consumes a lot of time and cells. The first type of test establishes a good compromise between the two criteria, the percentage of occupation of the circuit is lower and the reaction time is completely correct. I1 should not however forget its main drawback which concerns the fact that the descriptor overall has a larger bulk. Consequently, if it is modified very often, the time of the microcontroller devoted to writing the fields will increase considerably.

 The format used for the descriptor is then for example that given in the table of FIG. 5.

A program (Prog) or variable (Var 1 or
Var 2) is delimited by its low address and its high address. These comprising two bytes for example, the most significant (PFO) and the least significant (PFA) must be defined successively for each of them.

 The information Var l-type-authorized and Var 2type-authorized respectively define the types of access authorized to the corresponding zones, that is to say read, write or read / write for the zones of variables 1 and 2.

 In Fig. 6, the organization of a control device according to the invention has been shown more precisely.

This device is broken down into five fundamental blocks, namely a descriptor control and management block designated by the general reference 12, which includes an algorithm for managing the loading of the descriptor variable and which generates the control signals necessary for storage. address areas and access rights in the Comp-Prog, Comp-Var 1 and
Comp-Var 2, designated by the references 13, 14 and 15.

 The Comp-Prog block 13 includes the registers for storing the definition addresses of the descriptor program area. When executing an instruction (operating code or Opcode cycle), it generates a signal which indicates whether or not the address on the address bus is included in the authorized program area.

 The blocks Comp-Var 1 and Comp-Var 2 are identical and respectively include the registers for storing the addresses for defining the areas of variables 1 and 2. They also supply the signals which indicate whether the address for accessing the storage means present on the address bus is located in the authorized variable zones and if the access rights are respected. To add an additional variable zone to the descriptor, simply create another Comp-Var N block bearing the reference 16. The blocks presented previously are not modified.

The output block 17 formats the signals from the comparison blocks to supply the signals
VALID ACCESS or ERROR, usable by the storage means and the microcontroller.

 The operation of this device is controlled by the microcontroller via a supervisory block 18 which has the role of ensuring the activation or deactivation of this device according to the requests of the microcontroller.

 It can therefore be seen that in the device according to the invention, the control means are suitable for comparing access information, such as an address, with reference information to determine whether this access information corresponds to accessible memory areas. .

 This makes it possible to protect the memory areas against unauthorized access and to improve the operating reliability of the system.

 The device which is the subject of the invention has particularly advantageous advantages, the main one being that it requires only a small surface area of silicon, which on the one hand reduces the cost of the installation and, on the other hand, facilitates its integration in a microcontroller, which makes it particularly well suited for automotive applications.

 Finally, it will be noted that the control means can be arranged in any way, for example integrated into the microcontroller or in the memory or even as an external device.

Claims (15)

 1. Device for controlling the operation of an electronic system on board a motor vehicle, of the type comprising a unit (1) for processing information based on a microcontroller (2) associated with storage means ( 3) comprising areas (4) for storing codes corresponding to different programs executable by the microcontroller and, for each executable program, at least one area (5) for storing data accessible in writing and / or in reading by the microcontroller, characterized in that it includes means (6) for dynamic control of access by the microcontroller (2) to the storage areas, to generate an error signal in the direction of processing means errors (8) in the event of an attempt to access or access the microcontroller to unauthorized areas.  2. Device according to claim 1, characterized in that the control means (6) are further arranged to validate or not access to a storage area.  3. Device according to claim 1 or 2, characterized in that the control means comprise means (9, 10, 11, 12, 13, 14, 15, 16) for comparing information of access to information of predetermined reference (7) associated with the storage areas.  4. Device according to claim 3, characterized in that the reference information is stored in storage means (13, 14, 15, 16) of the control means.  5. Device according to claim 3 or 4, characterized in that the access information and the reference information are addresses for accessing the storage areas.  6. Device according to claim 5, characterized in that the comparison means are adapted to determine whether the access address is within an authorized interval.  7. Device according to claim 6, characterized in that said authorized interval is determined from reference information which includes a low address and a high address.  8. Device according to claim 6, characterized in that the reference information comprises a low address and an address offset value and in that the comparison means are adapted to determine whether the access address is between the low address and the low address plus the offset value.  9. Device according to claim 8, characterized in that the offset value is fixed.  10. Device according to claim 8, characterized in that the offset value is variable.  11. Device according to any one of claims 3 to 10, characterized in that the reference information includes information defining the access authorizations to one or other of the accessible data storage areas (5) by the microcontroller (2).  12. Device according to any one of the preceding claims, characterized in that its operation is controlled by the microcontroller (2) by means of a supervision block (18) which has the role of ensuring the activation or deactivation of this device according to requests from the microcontroller.  13. Device according to any one of the preceding claims, characterized in that the control means (6) are integrated in the microcontroller (2).  14. Device according to any one of claims 1 to 12, characterized in that the control means (6) are integrated in the storage means (3).  15. Device according to any one of claims 1 to 12, characterized in that the control means (6) are arranged as an external device.